# CVEs we are NOT affected by, with the reason -- so a customer query for a CVE absent from the affected list can be answered
# Format: CVE	PACKAGE	VERSION	REASON
CVE-2020-8927	brotli	1.2.0	fixed upstream in 0:1.0.6-3.el8; we ship 1.2.0
CVE-2025-6176	brotli	1.2.0	fixed upstream in 0:1.1.0-7.el10_1; we ship 1.2.0
CVE-2005-0758	bzip2-libs	1.0.8	fixed upstream in 0:1.0.2-11.EL3.4; we ship 1.0.8
CVE-2005-0953	bzip2-libs	1.0.8	fixed upstream in 0:1.0.2-11.EL3.4; we ship 1.0.8
CVE-2005-1260	bzip2-libs	1.0.8	fixed upstream in 0:1.0.2-11.EL3.4; we ship 1.0.8
CVE-2008-1372	bzip2-libs	1.0.8	fixed upstream in 0:1.0.1-5.EL2.1; we ship 1.0.8
CVE-2010-0405	bzip2-libs	1.0.8	fixed upstream in 0:1.0.5-7.el6_0; we ship 1.0.8
CVE-2019-12900	bzip2-libs	1.0.8	fixed upstream in 0:1.0.6-28.el8_10; we ship 1.0.8
CVE-2026-42250	bzip2-libs	1.0.8	the advisory is about bzip2recover ("bzip2recover utility"), a program we do not build -- we link the library
CVE-2005-0490	curl	8.23.0	fixed upstream in 0:7.10.6-6.rhel3; we ship 8.23.0
CVE-2005-4077	curl	8.23.0	fixed upstream in 0:7.12.1-8.rhel4; we ship 8.23.0
CVE-2009-0037	curl	8.23.0	fixed upstream in 0:7.8-3.rhel2; we ship 8.23.0
CVE-2009-2417	curl	8.23.0	fixed upstream in 0:7.10.6-10.rhel3; we ship 8.23.0
CVE-2010-0734	curl	8.23.0	fixed upstream in 0:7.15.5-9.el5; we ship 8.23.0
CVE-2011-2192	curl	8.23.0	fixed upstream in 0:7.12.1-17.el4; we ship 8.23.0
CVE-2013-1944	curl	8.23.0	fixed upstream in 0:7.15.5-16.el5_9; we ship 8.23.0
CVE-2013-2174	curl	8.23.0	fixed upstream in 0:7.15.5-17.el5_9; we ship 8.23.0
CVE-2014-0015	curl	8.23.0	fixed upstream in 0:7.19.7-37.el6_5.3; we ship 8.23.0
CVE-2014-0138	curl	8.23.0	fixed upstream in 0:7.19.7-37.el6_5.3; we ship 8.23.0
CVE-2014-3613	curl	8.23.0	fixed upstream in 0:7.29.0-25.el7; we ship 8.23.0
CVE-2014-3707	curl	8.23.0	fixed upstream in 0:7.29.0-25.el7; we ship 8.23.0
CVE-2014-8150	curl	8.23.0	fixed upstream in 0:7.29.0-25.el7; we ship 8.23.0
CVE-2015-3143	curl	8.23.0	fixed upstream in 0:7.29.0-25.el7; we ship 8.23.0
CVE-2015-3148	curl	8.23.0	fixed upstream in 0:7.29.0-25.el7; we ship 8.23.0
CVE-2016-5419	curl	8.23.0	fixed upstream in 0:7.29.0-35.el7; we ship 8.23.0
CVE-2016-5420	curl	8.23.0	fixed upstream in 0:7.29.0-35.el7; we ship 8.23.0
CVE-2016-7141	curl	8.23.0	fixed upstream in 0:7.29.0-35.el7; we ship 8.23.0
CVE-2016-7167	curl	8.23.0	fixed upstream in 0:7.29.0-42.el7; we ship 8.23.0
CVE-2017-1000257	curl	8.23.0	fixed upstream in 0:7.29.0-42.el7_4.1; we ship 8.23.0
CVE-2017-2628	curl	8.23.0	fixed upstream in 0:7.19.7-53.el6_9; we ship 8.23.0
CVE-2018-1000007	curl	8.23.0	fixed upstream in 0:7.29.0-51.el7; we ship 8.23.0
CVE-2018-1000120	curl	8.23.0	fixed upstream in 0:7.29.0-51.el7; we ship 8.23.0
CVE-2018-1000121	curl	8.23.0	fixed upstream in 0:7.29.0-51.el7; we ship 8.23.0
CVE-2018-1000122	curl	8.23.0	fixed upstream in 0:7.29.0-51.el7; we ship 8.23.0
CVE-2018-1000301	curl	8.23.0	fixed upstream in 0:7.29.0-51.el7; we ship 8.23.0
CVE-2018-14618	curl	8.23.0	fixed upstream in 0:7.29.0-51.el7_6.3; we ship 8.23.0
CVE-2018-16842	curl	8.23.0	fixed upstream in 0:7.29.0-54.el7; we ship 8.23.0
CVE-2018-16890	curl	8.23.0	fixed upstream in 0:7.61.1-11.el8; we ship 8.23.0
CVE-2018-20483	curl	8.23.0	fixed upstream in 0:7.61.1-11.el8; we ship 8.23.0
CVE-2019-3822	curl	8.23.0	fixed upstream in 0:7.61.1-11.el8; we ship 8.23.0
CVE-2019-3823	curl	8.23.0	fixed upstream in 0:7.61.1-11.el8; we ship 8.23.0
CVE-2019-5436	curl	8.23.0	fixed upstream in 0:7.61.1-12.el8; we ship 8.23.0
CVE-2019-5481	curl	8.23.0	fixed upstream in 0:7.61.1-12.el8; we ship 8.23.0
CVE-2019-5482	curl	8.23.0	fixed upstream in 0:7.61.1-12.el8; we ship 8.23.0
CVE-2020-8177	curl	8.23.0	fixed upstream in 0:7.61.1-14.el8; we ship 8.23.0
CVE-2020-8231	curl	8.23.0	fixed upstream in 0:7.61.1-18.el8; we ship 8.23.0
CVE-2020-8284	curl	8.23.0	fixed upstream in 0:7.61.1-18.el8; we ship 8.23.0
CVE-2020-8285	curl	8.23.0	fixed upstream in 0:7.61.1-18.el8; we ship 8.23.0
CVE-2020-8286	curl	8.23.0	fixed upstream in 0:7.61.1-18.el8; we ship 8.23.0
CVE-2021-22876	curl	8.23.0	fixed upstream in 0:7.61.1-22.el8; we ship 8.23.0
CVE-2021-22898	curl	8.23.0	fixed upstream in 0:7.61.1-22.el8; we ship 8.23.0
CVE-2021-22922	curl	8.23.0	fixed upstream in 0:7.61.1-18.el8_4.1; we ship 8.23.0
CVE-2021-22923	curl	8.23.0	fixed upstream in 0:7.61.1-18.el8_4.1; we ship 8.23.0
CVE-2021-22924	curl	8.23.0	fixed upstream in 0:7.61.1-18.el8_4.1; we ship 8.23.0
CVE-2021-22925	curl	8.23.0	fixed upstream in 0:7.61.1-22.el8; we ship 8.23.0
CVE-2021-22946	curl	8.23.0	fixed upstream in 0:7.61.1-18.el8_4.2; we ship 8.23.0
CVE-2021-22947	curl	8.23.0	fixed upstream in 0:7.61.1-18.el8_4.2; we ship 8.23.0
CVE-2022-22576	curl	8.23.0	fixed upstream in 0:7.76.1-14.el9_0.4; we ship 8.23.0
CVE-2022-27774	curl	8.23.0	fixed upstream in 0:7.76.1-14.el9_0.4; we ship 8.23.0
CVE-2022-27775	curl	8.23.0	fixed upstream in 0:7.76.1-19.el9; we ship 8.23.0
CVE-2022-27776	curl	8.23.0	fixed upstream in 0:7.76.1-14.el9_0.4; we ship 8.23.0
CVE-2022-27782	curl	8.23.0	fixed upstream in 0:7.76.1-14.el9_0.4; we ship 8.23.0
CVE-2022-32206	curl	8.23.0	fixed upstream in 0:7.76.1-14.el9_0.5; we ship 8.23.0
CVE-2022-32207	curl	8.23.0	fixed upstream in 0:7.76.1-14.el9_0.5; we ship 8.23.0
CVE-2022-32208	curl	8.23.0	fixed upstream in 0:7.76.1-14.el9_0.5; we ship 8.23.0
CVE-2022-32221	curl	8.23.0	fixed upstream in 0:7.76.1-19.el9_1.1; we ship 8.23.0
CVE-2022-35252	curl	8.23.0	fixed upstream in 0:7.76.1-23.el9; we ship 8.23.0
CVE-2022-43552	curl	8.23.0	fixed upstream in 0:7.76.1-23.el9; we ship 8.23.0
CVE-2023-23916	curl	8.23.0	fixed upstream in 0:7.76.1-19.el9_1.2; we ship 8.23.0
CVE-2023-27533	curl	8.23.0	fixed upstream in 0:7.76.1-26.el9; we ship 8.23.0
CVE-2023-27534	curl	8.23.0	fixed upstream in 0:7.76.1-26.el9; we ship 8.23.0
CVE-2023-27535	curl	8.23.0	fixed upstream in 0:7.76.1-23.el9_2.1; we ship 8.23.0
CVE-2023-27536	curl	8.23.0	fixed upstream in 0:7.76.1-26.el9; we ship 8.23.0
CVE-2023-27538	curl	8.23.0	fixed upstream in 0:7.76.1-26.el9; we ship 8.23.0
CVE-2023-28321	curl	8.23.0	fixed upstream in 0:7.76.1-23.el9_2.2; we ship 8.23.0
CVE-2023-28322	curl	8.23.0	fixed upstream in 0:7.76.1-23.el9_2.2; we ship 8.23.0
CVE-2023-38545	curl	8.23.0	fixed upstream in 0:7.76.1-26.el9_3.2; we ship 8.23.0
CVE-2023-38546	curl	8.23.0	fixed upstream in 0:7.76.1-26.el9_3.2; we ship 8.23.0
CVE-2023-46218	curl	8.23.0	fixed upstream in 0:7.76.1-26.el9_3.3; we ship 8.23.0
CVE-2024-2398	curl	8.23.0	fixed upstream in 0:7.76.1-29.el9_4.1; we ship 8.23.0
CVE-2025-10148	curl	8.23.0	fixed upstream in 0:8.19.0-3.hum1; we ship 8.23.0
CVE-2025-10966	curl	8.23.0	fixed upstream in 0:8.19.0-3.hum1; we ship 8.23.0
CVE-2025-13034	curl	8.23.0	fixed upstream in 0:8.19.0-3.hum1; we ship 8.23.0
CVE-2025-14017	curl	8.23.0	curl lists 143 affected release(s) and 8.23.0 is not among them; fixed in 8.14.2
CVE-2025-14524	curl	8.23.0	fixed upstream in 0:8.19.0-3.hum1; we ship 8.23.0
CVE-2025-14819	curl	8.23.0	curl lists 31 affected release(s) and 8.23.0 is not among them; fixed in 8.14.2
CVE-2025-15079	curl	8.23.0	fixed upstream in 0:8.19.0-3.hum1; we ship 8.23.0
CVE-2025-15224	curl	8.23.0	fixed upstream in 0:8.19.0-3.hum1; we ship 8.23.0
CVE-2025-9086	curl	8.23.0	curl lists 4 affected release(s) and 8.23.0 is not among them; fixed in 8.14.2
CVE-2026-10536	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.1.hum1; we ship 8.23.0
CVE-2026-107928	curl	8.23.0	curl lists 37 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-107929	curl	8.23.0	curl lists 19 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-11352	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-11564	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-11586	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-11856	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-12064	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-13608	curl	8.23.0	fixed upstream in 0:8.22.0-0.1.hum1; we ship 8.23.0
CVE-2026-18924	curl	8.23.0	fixed upstream in 0:8.22.0-0.1.hum1; we ship 8.23.0
CVE-2026-1965	curl	8.23.0	fixed upstream in 0:8.22.0-1.1.hum1; we ship 8.23.0
CVE-2026-19931	curl	8.23.0	fixed upstream in 0:8.22.0-0.1.hum1; we ship 8.23.0
CVE-2026-3783	curl	8.23.0	fixed upstream in 0:8.22.0-1.1.hum1; we ship 8.23.0
CVE-2026-3784	curl	8.23.0	fixed upstream in 0:8.22.0-1.1.hum1; we ship 8.23.0
CVE-2026-3805	curl	8.23.0	fixed upstream in 0:8.19.0-3.hum1; we ship 8.23.0
CVE-2026-4873	curl	8.23.0	fixed upstream in 0:8.20.0-0.1.hum1; we ship 8.23.0
CVE-2026-5545	curl	8.23.0	fixed upstream in 0:8.20.0-0.1.hum1; we ship 8.23.0
CVE-2026-5773	curl	8.23.0	fixed upstream in 0:8.20.0-0.1.hum1; we ship 8.23.0
CVE-2026-58055	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.1.hum1; we ship 8.23.0
CVE-2026-6253	curl	8.23.0	fixed upstream in 0:8.20.0-0.1.hum1; we ship 8.23.0
CVE-2026-6276	curl	8.23.0	fixed upstream in 0:8.20.0-0.1.hum1; we ship 8.23.0
CVE-2026-6429	curl	8.23.0	fixed upstream in 0:8.20.0-0.1.hum1; we ship 8.23.0
CVE-2026-7009	curl	8.23.0	fixed upstream in 0:8.20.0-2.hum1; we ship 8.23.0
CVE-2026-7168	curl	8.23.0	fixed upstream in 0:8.20.0-2.hum1; we ship 8.23.0
CVE-2026-80229	curl	8.23.0	fixed upstream in 0:8.22.0-0.1.hum1; we ship 8.23.0
CVE-2026-80230	curl	8.23.0	fixed upstream in 0:8.22.0-0.1.hum1; we ship 8.23.0
CVE-2026-80231	curl	8.23.0	fixed upstream in 0:8.22.0-0.1.hum1; we ship 8.23.0
CVE-2026-80255	curl	8.23.0	fixed upstream in 0:8.22.0-0.1.hum1; we ship 8.23.0
CVE-2026-82209	curl	8.23.0	fixed upstream in 0:8.22.0-0.1.hum1; we ship 8.23.0
CVE-2026-8286	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-8458	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-86409	curl	8.23.0	curl lists 50 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-86410	curl	8.23.0	curl scopes this CVE to the command line program (affects: tool); we link libcurl and ship no curl program
CVE-2026-86411	curl	8.23.0	curl lists 1 affected release(s) and 8.23.0 is not among them; fixed in 8.22.0
CVE-2026-86412	curl	8.23.0	curl lists 5 affected release(s) and 8.23.0 is not among them; fixed in 8.20.2
CVE-2026-86413	curl	8.23.0	curl lists 2 affected release(s) and 8.23.0 is not among them; fixed in 8.23.0
CVE-2026-86414	curl	8.23.0	curl lists 172 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-87861	curl	8.23.0	curl lists 2 affected release(s) and 8.23.0 is not among them; fixed in 8.23.0
CVE-2026-87862	curl	8.23.0	curl lists 15 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-87863	curl	8.23.0	curl lists 28 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-87864	curl	8.23.0	curl lists 114 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-87865	curl	8.23.0	curl lists 58 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-87866	curl	8.23.0	curl lists 100 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-8924	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-8925	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-8926	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-8927	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-8932	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-9079	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-9080	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-92386	curl	8.23.0	curl lists 22 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-92387	curl	8.23.0	curl lists 17 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-92388	curl	8.23.0	curl lists 133 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-92389	curl	8.23.0	curl lists 159 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-92390	curl	8.23.0	curl scopes this CVE to the command line program (affects: tool); we link libcurl and ship no curl program
CVE-2026-92391	curl	8.23.0	curl lists 78 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-92392	curl	8.23.0	curl lists 13 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-94265	curl	8.23.0	curl lists 2 affected release(s) and 8.23.0 is not among them; fixed in 8.23.0
CVE-2026-94266	curl	8.23.0	curl lists 70 affected release(s) and 8.23.0 is not among them; fixed in 8.14.3
CVE-2026-9545	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.1.hum1; we ship 8.23.0
CVE-2026-9546	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2026-9547	curl	8.23.0	fixed upstream in 0:8.21.0-0.1.hum1; we ship 8.23.0
CVE-2009-3560	expat	2.9.0	fixed upstream in 0:1.95.5-6.2; we ship 2.9.0
CVE-2009-3720	expat	2.9.0	fixed upstream in 0:1.95.5-6.2; we ship 2.9.0
CVE-2012-0876	expat	2.9.0	fixed upstream in 0:1.95.8-11.el5_8; we ship 2.9.0
CVE-2012-1148	expat	2.9.0	fixed upstream in 0:1.95.8-11.el5_8; we ship 2.9.0
CVE-2013-0340	expat	2.9.0	fixed upstream in 0:2.5.0-1.el8_10; we ship 2.9.0
CVE-2015-2716	expat	2.9.0	fixed upstream in 0:2.1.0-11.el7_7; we ship 2.9.0
CVE-2016-0718	expat	2.9.0	fixed upstream in 0:2.0.1-13.el6_8; we ship 2.9.0
CVE-2018-20843	expat	2.9.0	fixed upstream in 0:2.2.10-1.el8_2; we ship 2.9.0
CVE-2019-15903	expat	2.9.0	fixed upstream in 0:2.2.10-1.el8_2; we ship 2.9.0
CVE-2021-45960	expat	2.9.0	fixed upstream in 0:2.2.10-1.el8_4; we ship 2.9.0
CVE-2021-46143	expat	2.9.0	fixed upstream in 0:2.2.10-12.el9_0; we ship 2.9.0
CVE-2022-22822	expat	2.9.0	fixed upstream in 0:2.2.10-12.el9_0; we ship 2.9.0
CVE-2022-22823	expat	2.9.0	fixed upstream in 0:2.2.10-12.el9_0; we ship 2.9.0
CVE-2022-22824	expat	2.9.0	fixed upstream in 0:2.2.10-12.el9_0; we ship 2.9.0
CVE-2022-22825	expat	2.9.0	fixed upstream in 0:2.2.10-12.el9_0; we ship 2.9.0
CVE-2022-22826	expat	2.9.0	fixed upstream in 0:2.2.10-12.el9_0; we ship 2.9.0
CVE-2022-22827	expat	2.9.0	fixed upstream in 0:2.2.10-12.el9_0; we ship 2.9.0
CVE-2022-23852	expat	2.9.0	fixed upstream in 0:2.2.10-12.el9_0; we ship 2.9.0
CVE-2022-23990	expat	2.9.0	fixed upstream in 0:2.5.0-1.el8_10; we ship 2.9.0
CVE-2022-25235	expat	2.9.0	fixed upstream in 0:2.2.10-12.el9_0; we ship 2.9.0
CVE-2022-25236	expat	2.9.0	fixed upstream in 0:2.2.5-4.el8_5.3; we ship 2.9.0
CVE-2022-25313	expat	2.9.0	fixed upstream in 0:2.2.10-12.el9_0.2; we ship 2.9.0
CVE-2022-25314	expat	2.9.0	fixed upstream in 0:2.2.10-12.el9_0.2; we ship 2.9.0
CVE-2022-25315	expat	2.9.0	fixed upstream in 0:2.2.10-12.el9_0; we ship 2.9.0
CVE-2022-40674	expat	2.9.0	fixed upstream in 0:2.2.10-12.el9_0.3; we ship 2.9.0
CVE-2022-43680	expat	2.9.0	fixed upstream in 0:2.4.9-1.el9_1.1; we ship 2.9.0
CVE-2023-52425	expat	2.9.0	fixed upstream in 0:2.5.0-1.el9_3.1; we ship 2.9.0
CVE-2024-28757	expat	2.9.0	fixed upstream in 0:2.5.0-2.el9_4; we ship 2.9.0
CVE-2024-45490	expat	2.9.0	fixed upstream in 0:2.5.0-2.el9_4.1; we ship 2.9.0
CVE-2024-45491	expat	2.9.0	fixed upstream in 0:2.5.0-2.el9_4.1; we ship 2.9.0
CVE-2024-45492	expat	2.9.0	fixed upstream in 0:2.5.0-2.el9_4.1; we ship 2.9.0
CVE-2024-50602	expat	2.9.0	fixed upstream in 0:2.5.0-3.el9_5.1; we ship 2.9.0
CVE-2024-8176	expat	2.9.0	fixed upstream in 0:2.7.1-1.el10_0; we ship 2.9.0
CVE-2025-59375	expat	2.9.0	fixed upstream in 0:2.7.5-1.hum1; we ship 2.9.0
CVE-2026-41080	expat	2.9.0	fixed upstream in 0:2.8.0-0.1.hum1; we ship 2.9.0
CVE-2026-45186	expat	2.9.0	fixed upstream in 0:2.8.5-1.1.hum1; we ship 2.9.0
CVE-2026-50219	expat	2.9.0	fixed upstream in 0:2.8.2-1.hum1; we ship 2.9.0
CVE-2026-56131	expat	2.9.0	fixed upstream in 0:2.8.2-1.1.hum1; we ship 2.9.0
CVE-2026-56132	expat	2.9.0	fixed upstream in 0:2.8.2-1.hum1; we ship 2.9.0
CVE-2026-56404	expat	2.9.0	fixed upstream in 0:2.8.2-1.1.hum1; we ship 2.9.0
CVE-2026-56407	expat	2.9.0	fixed upstream in 0:2.8.2-1.1.hum1; we ship 2.9.0
CVE-2026-56411	expat	2.9.0	fixed upstream in 0:2.8.4-0.1.hum1; we ship 2.9.0
CVE-2026-66046	expat	2.9.0	fixed upstream in 0:2.8.4-0.1.hum1; we ship 2.9.0
CVE-2026-72522	expat	2.9.0	fixed upstream in 0:2.8.3-0.1.hum1; we ship 2.9.0
CVE-2026-76641	expat	2.9.0	fixed upstream in 0:2.8.4-0.1.hum1; we ship 2.9.0
CVE-2026-76956	expat	2.9.0	fixed upstream in 0:2.8.4-0.1.hum1; we ship 2.9.0
CVE-2026-76957	expat	2.9.0	fixed upstream in 0:2.8.4-0.1.hum1; we ship 2.9.0
CVE-2026-77214	expat	2.9.0	fixed upstream in 0:2.8.5-1.2.hum1; we ship 2.9.0
CVE-2026-93990	expat	2.9.0	fixed upstream in 0:2.8.4-0.2.hum1; we ship 2.9.0
CVE-2019-18224	libidn2	2.3.8	fixed upstream in 0:2.2.0-1.el8; we ship 2.3.8
CVE-2026-57053	libidn2	2.3.8	not applicable: GNU libidn 1.x defect (idna_to_unicode_internal, fixed in libidn 1.44) -- not libidn2; Red Hat states libidn2 is unaffected, and the function is absent from lib/libidn2
CVE-2016-0739	libssh	0.12.2	fixed upstream in 0:0.7.1-2.el7; we ship 0.12.2
CVE-2018-10933	libssh	0.12.2	fixed upstream in 0:0.7.1-7.el7; we ship 0.12.2
CVE-2019-14889	libssh	0.12.2	fixed upstream in 0:0.9.4-2.el8; we ship 0.12.2
CVE-2020-16135	libssh	0.12.2	fixed upstream in 0:0.9.4-3.el8; we ship 0.12.2
CVE-2020-1730	libssh	0.12.2	fixed upstream in 0:0.9.4-2.el8; we ship 0.12.2
CVE-2021-3634	libssh	0.12.2	fixed upstream in 0:0.9.6-3.el8; we ship 0.12.2
CVE-2023-1667	libssh	0.12.2	fixed upstream in 0:0.10.4-11.el9; we ship 0.12.2
CVE-2023-2283	libssh	0.12.2	fixed upstream in 0:0.10.4-11.el9; we ship 0.12.2
CVE-2023-48795	libssh	0.12.2	fixed upstream in 0:0.10.4-12.el9_3; we ship 0.12.2
CVE-2023-6004	libssh	0.12.2	fixed upstream in 0:0.10.4-13.el9; we ship 0.12.2
CVE-2023-6918	libssh	0.12.2	fixed upstream in 0:0.10.4-13.el9; we ship 0.12.2
CVE-2025-14821	libssh	0.12.2	fixed upstream in 0:0.12.0-1.1.hum1; we ship 0.12.2
CVE-2025-4877	libssh	0.12.2	fixed upstream in 0:0.10.4-18.el9; we ship 0.12.2
CVE-2025-4878	libssh	0.12.2	fixed upstream in 0:0.10.4-18.el9; we ship 0.12.2
CVE-2025-5318	libssh	0.12.2	fixed upstream in 0:0.11.1-4.el10_1; we ship 0.12.2
CVE-2025-5351	libssh	0.12.2	fixed upstream in 0:0.10.4-18.el9; we ship 0.12.2
CVE-2025-5372	libssh	0.12.2	fixed upstream in 0:0.9.6-16.el8_10; we ship 0.12.2
CVE-2025-5987	libssh	0.12.2	fixed upstream in 0:0.11.1-5.el10_1; we ship 0.12.2
CVE-2025-8114	libssh	0.12.2	fixed upstream in 0:0.10.4-18.el9; we ship 0.12.2
CVE-2025-8277	libssh	0.12.2	fixed upstream in 0:0.10.4-18.el9; we ship 0.12.2
CVE-2026-0964	libssh	0.12.2	fixed upstream in 0:0.12.0-2.el10; we ship 0.12.2
CVE-2026-0965	libssh	0.12.2	fixed upstream in 0:0.12.0-2.el10; we ship 0.12.2
CVE-2026-0966	libssh	0.12.2	fixed upstream in 0:0.12.0-2.el10; we ship 0.12.2
CVE-2026-0967	libssh	0.12.2	fixed upstream in 0:0.12.0-2.el10; we ship 0.12.2
CVE-2026-0968	libssh	0.12.2	fixed upstream in 0:0.12.0-2.el10; we ship 0.12.2
CVE-2026-15370	libssh	0.12.2	not applicable: fixed upstream in 0.12.1; we ship 0.12.2 (lib/libssh/CHANGELOG) -- and the defect is in the SFTP server role, while FL5 is a client
CVE-2026-3731	libssh	0.12.2	fixed upstream in 0:0.12.0-1.1.hum1; we ship 0.12.2
CVE-2026-59842	libssh	0.12.2	fixed upstream in 0:0.12.1-4.hum1; we ship 0.12.2
CVE-2026-59843	libssh	0.12.2	fixed upstream in 0:0.12.1-4.hum1; we ship 0.12.2
CVE-2026-59844	libssh	0.12.2	fixed upstream in 0:0.12.1-4.hum1; we ship 0.12.2
CVE-2026-59845	libssh	0.12.2	fixed upstream in 0:0.12.1-4.hum1; we ship 0.12.2
CVE-2026-59846	libssh	0.12.2	fixed upstream in 0:0.12.1-4.hum1; we ship 0.12.2
CVE-2026-59847	libssh	0.12.2	fixed upstream in 0:0.12.1-4.hum1; we ship 0.12.2
CVE-2026-59848	libssh	0.12.2	fixed upstream in 0:0.12.1-4.hum1; we ship 0.12.2
CVE-2026-59849	libssh	0.12.2	fixed upstream in 0:0.12.1-4.hum1; we ship 0.12.2
CVE-2026-59850	libssh	0.12.2	fixed upstream in 0:0.12.1-4.hum1; we ship 0.12.2
CVE-2026-59851	libssh	0.12.2	fixed upstream in 0:0.12.1-4.hum1; we ship 0.12.2
CVE-2019-11922	libzstd	1.5.7	fixed upstream in 1.3.8+dfsg-2; we ship 1.5.7
CVE-2021-24031	libzstd	1.5.7	fixed upstream in 1.4.8+dfsg-1; we ship 1.5.7
CVE-2021-24032	libzstd	1.5.7	fixed upstream in 1.4.8+dfsg-2; we ship 1.5.7
CVE-2022-4899	libzstd	1.5.7	fixed upstream in 1.5.4+dfsg2-1; we ship 1.5.7
CVE-2019-16224	lmdb	0.9.70	not applicable: py-lmdb 0.97, the Python binding (CPE py-lmdb_project:py-lmdb) -- not the C library we link
CVE-2019-16225	lmdb	0.9.70	not applicable: py-lmdb 0.97, the Python binding (CPE py-lmdb_project:py-lmdb) -- not the C library we link
CVE-2019-16226	lmdb	0.9.70	not applicable: py-lmdb 0.97, the Python binding (CPE py-lmdb_project:py-lmdb) -- not the C library we link
CVE-2019-16227	lmdb	0.9.70	not applicable: py-lmdb 0.97, the Python binding (CPE py-lmdb_project:py-lmdb) -- not the C library we link
CVE-2019-16228	lmdb	0.9.70	not applicable: py-lmdb 0.97, the Python binding (CPE py-lmdb_project:py-lmdb) -- not the C library we link
CVE-2019-17543	lz4-libs	1.10.0	fixed upstream in 0:1.8.3-5.el8_10; we ship 1.10.0
CVE-2021-3520	lz4-libs	1.10.0	fixed upstream in 0:1.8.3-3.el8_4; we ship 1.10.0
CVE-2019-9511	nghttp2	1.70.0	fixed upstream in 0:1.33.0-1.el8_0.1; we ship 1.70.0
CVE-2019-9513	nghttp2	1.70.0	fixed upstream in 0:1.33.0-1.el8_0.1; we ship 1.70.0
CVE-2020-11080	nghttp2	1.70.0	fixed upstream in 0:1.33.0-3.el8_2.1; we ship 1.70.0
CVE-2023-44487	nghttp2	1.70.0	fixed upstream in 0:1.43.0-5.el9_3.1; we ship 1.70.0
CVE-2024-28182	nghttp2	1.70.0	fixed upstream in 0:1.43.0-5.el9_4.3; we ship 1.70.0
CVE-2026-27135	nghttp2	1.70.0	fixed upstream in 0:1.69.0-6.1.hum1; we ship 1.70.0
CVE-2026-58055	nghttp2	1.70.0	fixed upstream in 0:1.69.0-5.hum1; we ship 1.70.0
CVE-2026-40170	ngtcp2	1.25.0	fixed upstream in 0:1.22.1-1.hum1; we ship 1.25.0
CVE-2004-0079	openssl	3.6.1	fixed upstream in 0:0.9.7a-33.4; we ship 3.6.1
CVE-2004-0081	openssl	3.6.1	fixed upstream in 0:0.9.7a-33.4; we ship 3.6.1
CVE-2004-0112	openssl	3.6.1	fixed upstream in 0:0.9.7a-33.4; we ship 3.6.1
CVE-2004-0975	openssl	3.6.1	fixed upstream in 0:0.9.7a-33.15; we ship 3.6.1
CVE-2005-0109	openssl	3.6.1	fixed upstream in 0:0.9.7a-33.17; we ship 3.6.1
CVE-2005-2969	openssl	3.6.1	fixed upstream in 0:0.9.7a-33.17; we ship 3.6.1
CVE-2006-2937	openssl	3.6.1	fixed upstream in 0:0.9.6b-46; we ship 3.6.1
CVE-2006-2940	openssl	3.6.1	fixed upstream in 0:0.9.6b-46; we ship 3.6.1
CVE-2006-3738	openssl	3.6.1	fixed upstream in 0:0.9.6b-46; we ship 3.6.1
CVE-2006-4343	openssl	3.6.1	fixed upstream in 0:0.9.6b-46; we ship 3.6.1
CVE-2006-7250	openssl	3.6.1	fixed upstream in 0:0.9.8e-12.el5; we ship 3.6.1
CVE-2007-3108	openssl	3.6.1	fixed upstream in 0:0.9.8b-8.3.el5_0.2; we ship 3.6.1
CVE-2007-4995	openssl	3.6.1	fixed upstream in 0:0.9.8b-8.3.el5_0.2; we ship 3.6.1
CVE-2007-5135	openssl	3.6.1	fixed upstream in 0:0.9.8b-8.3.el5_0.2; we ship 3.6.1
CVE-2008-5077	openssl	3.6.1	fixed upstream in 0:0.9.6b-49; we ship 3.6.1
CVE-2008-7270	openssl	3.6.1	fixed upstream in 0:0.9.8e-12.el5_5.7; we ship 3.6.1
CVE-2009-0590	openssl	3.6.1	fixed upstream in 0:0.9.8e-12.el5; we ship 3.6.1
CVE-2009-1377	openssl	3.6.1	fixed upstream in 0:0.9.8e-12.el5; we ship 3.6.1
CVE-2009-1378	openssl	3.6.1	fixed upstream in 0:0.9.8e-12.el5; we ship 3.6.1
CVE-2009-1379	openssl	3.6.1	fixed upstream in 0:0.9.8e-12.el5; we ship 3.6.1
CVE-2009-1386	openssl	3.6.1	fixed upstream in 0:0.9.8e-12.el5; we ship 3.6.1
CVE-2009-1387	openssl	3.6.1	fixed upstream in 0:0.9.8e-12.el5; we ship 3.6.1
CVE-2009-2409	openssl	3.6.1	fixed upstream in 0:0.9.8e-12.el5_4.1; we ship 3.6.1
CVE-2009-3245	openssl	3.6.1	fixed upstream in 0:0.9.8e-12.el5_4.6; we ship 3.6.1
CVE-2009-3555	openssl	3.6.1	fixed upstream in 0:0.9.8e-12.el5_4.6; we ship 3.6.1
CVE-2009-4355	openssl	3.6.1	fixed upstream in 0:0.9.8e-12.el5_4.1; we ship 3.6.1
CVE-2010-0433	openssl	3.6.1	fixed upstream in 0:0.9.8e-12.el5_4.6; we ship 3.6.1
CVE-2010-3864	openssl	3.6.1	fixed upstream in 0:1.0.0-4.el6_0.1; we ship 3.6.1
CVE-2010-4180	openssl	3.6.1	fixed upstream in 0:1.0.0-4.el6_0.2; we ship 3.6.1
CVE-2010-5298	openssl	3.6.1	fixed upstream in 1:1.0.1e-34.el7_0.3; we ship 3.6.1
CVE-2011-0014	openssl	3.6.1	fixed upstream in 0:1.0.0-10.el6; we ship 3.6.1
CVE-2011-3207	openssl	3.6.1	fixed upstream in 0:1.0.0-10.el6_1.5; we ship 3.6.1
CVE-2011-4108	openssl	3.6.1	fixed upstream in 0:1.0.0-20.el6_2.1; we ship 3.6.1
CVE-2011-4109	openssl	3.6.1	fixed upstream in 0:0.9.8e-20.el5_7.1; we ship 3.6.1
CVE-2011-4576	openssl	3.6.1	fixed upstream in 0:1.0.0-20.el6_2.1; we ship 3.6.1
CVE-2011-4577	openssl	3.6.1	fixed upstream in 0:1.0.0-20.el6_2.1; we ship 3.6.1
CVE-2011-4619	openssl	3.6.1	fixed upstream in 0:1.0.0-20.el6_2.1; we ship 3.6.1
CVE-2012-0884	openssl	3.6.1	fixed upstream in 0:0.9.8e-22.el5_8.1; we ship 3.6.1
CVE-2012-1165	openssl	3.6.1	fixed upstream in 0:0.9.8e-22.el5_8.1; we ship 3.6.1
CVE-2012-2110	openssl	3.6.1	fixed upstream in 0:0.9.8e-22.el5_8.3; we ship 3.6.1
CVE-2012-2333	openssl	3.6.1	fixed upstream in 0:0.9.8e-22.el5_8.4; we ship 3.6.1
CVE-2012-4929	openssl	3.6.1	fixed upstream in 0:0.9.8e-26.el5_9.1; we ship 3.6.1
CVE-2013-0166	openssl	3.6.1	fixed upstream in 0:0.9.8e-26.el5_9.1; we ship 3.6.1
CVE-2013-0169	openssl	3.6.1	fixed upstream in 0:0.9.8e-26.el5_9.1; we ship 3.6.1
CVE-2013-4353	openssl	3.6.1	fixed upstream in 0:1.0.1e-16.el6_5.4; we ship 3.6.1
CVE-2013-6449	openssl	3.6.1	fixed upstream in 0:1.0.1e-16.el6_5.4; we ship 3.6.1
CVE-2013-6450	openssl	3.6.1	fixed upstream in 0:1.0.1e-16.el6_5.4; we ship 3.6.1
CVE-2014-0160	openssl	3.6.1	fixed upstream in 0:1.0.1e-16.el6_5.7; we ship 3.6.1
CVE-2014-0195	openssl	3.6.1	fixed upstream in 1:1.0.1e-34.el7_0.3; we ship 3.6.1
CVE-2014-0198	openssl	3.6.1	fixed upstream in 1:1.0.1e-34.el7_0.3; we ship 3.6.1
CVE-2014-0221	openssl	3.6.1	fixed upstream in 1:1.0.1e-34.el7_0.3; we ship 3.6.1
CVE-2014-0224	openssl	3.6.1	fixed upstream in 1:1.0.1e-34.el7_0.3; we ship 3.6.1
CVE-2014-3470	openssl	3.6.1	fixed upstream in 1:1.0.1e-34.el7_0.3; we ship 3.6.1
CVE-2014-3505	openssl	3.6.1	fixed upstream in 0:1.0.1e-16.el6_5.15; we ship 3.6.1
CVE-2014-3506	openssl	3.6.1	fixed upstream in 0:1.0.1e-16.el6_5.15; we ship 3.6.1
CVE-2014-3507	openssl	3.6.1	fixed upstream in 0:1.0.1e-16.el6_5.15; we ship 3.6.1
CVE-2014-3508	openssl	3.6.1	fixed upstream in 0:1.0.1e-16.el6_5.15; we ship 3.6.1
CVE-2014-3509	openssl	3.6.1	fixed upstream in 0:1.0.1e-16.el6_5.15; we ship 3.6.1
CVE-2014-3510	openssl	3.6.1	fixed upstream in 0:1.0.1e-16.el6_5.15; we ship 3.6.1
CVE-2014-3511	openssl	3.6.1	fixed upstream in 0:1.0.1e-16.el6_5.15; we ship 3.6.1
CVE-2014-3513	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.2; we ship 3.6.1
CVE-2014-3567	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.2; we ship 3.6.1
CVE-2014-3570	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.5; we ship 3.6.1
CVE-2014-3571	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.5; we ship 3.6.1
CVE-2014-3572	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.5; we ship 3.6.1
CVE-2014-8176	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.11; we ship 3.6.1
CVE-2014-8275	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.5; we ship 3.6.1
CVE-2015-0204	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.5; we ship 3.6.1
CVE-2015-0205	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.5; we ship 3.6.1
CVE-2015-0206	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.5; we ship 3.6.1
CVE-2015-0209	openssl	3.6.1	fixed upstream in 1:1.0.1e-42.el7_1.4; we ship 3.6.1
CVE-2015-0286	openssl	3.6.1	fixed upstream in 1:1.0.1e-42.el7_1.4; we ship 3.6.1
CVE-2015-0287	openssl	3.6.1	fixed upstream in 1:1.0.1e-42.el7_1.4; we ship 3.6.1
CVE-2015-0288	openssl	3.6.1	fixed upstream in 1:1.0.1e-42.el7_1.4; we ship 3.6.1
CVE-2015-0289	openssl	3.6.1	fixed upstream in 1:1.0.1e-42.el7_1.4; we ship 3.6.1
CVE-2015-0292	openssl	3.6.1	fixed upstream in 1:1.0.1e-42.el7_1.4; we ship 3.6.1
CVE-2015-0293	openssl	3.6.1	fixed upstream in 1:1.0.1e-42.el7_1.4; we ship 3.6.1
CVE-2015-1789	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.11; we ship 3.6.1
CVE-2015-1790	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.11; we ship 3.6.1
CVE-2015-1791	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.11; we ship 3.6.1
CVE-2015-1792	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.11; we ship 3.6.1
CVE-2015-3194	openssl	3.6.1	fixed upstream in 0:1.0.1e-42.el6_7.1; we ship 3.6.1
CVE-2015-3195	openssl	3.6.1	fixed upstream in 0:1.0.1e-42.el6_7.1; we ship 3.6.1
CVE-2015-3196	openssl	3.6.1	fixed upstream in 0:1.0.1e-42.el6_7.1; we ship 3.6.1
CVE-2015-3197	openssl	3.6.1	fixed upstream in 0:1.0.1e-42.el6_7.4; we ship 3.6.1
CVE-2015-3216	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.11; we ship 3.6.1
CVE-2015-4000	openssl	3.6.1	fixed upstream in 0:1.0.1e-30.el6_6.9; we ship 3.6.1
CVE-2015-7575	openssl	3.6.1	fixed upstream in 0:1.0.1e-42.el6_7.2; we ship 3.6.1
CVE-2016-0702	openssl	3.6.1	fixed upstream in 0:1.0.1e-42.el6_7.4; we ship 3.6.1
CVE-2016-0703	openssl	3.6.1	fixed upstream in 1:1.0.1e-42.el7_1.4; we ship 3.6.1
CVE-2016-0704	openssl	3.6.1	fixed upstream in 1:1.0.1e-42.el7_1.4; we ship 3.6.1
CVE-2016-0705	openssl	3.6.1	fixed upstream in 0:1.0.1e-42.el6_7.4; we ship 3.6.1
CVE-2016-0797	openssl	3.6.1	fixed upstream in 0:1.0.1e-42.el6_7.4; we ship 3.6.1
CVE-2016-0799	openssl	3.6.1	fixed upstream in 1:1.0.1e-51.el7_2.5; we ship 3.6.1
CVE-2016-0800	openssl	3.6.1	fixed upstream in 0:1.0.1e-42.el6_7.4; we ship 3.6.1
CVE-2016-2105	openssl	3.6.1	fixed upstream in 1:1.0.1e-51.el7_2.5; we ship 3.6.1
CVE-2016-2106	openssl	3.6.1	fixed upstream in 1:1.0.1e-51.el7_2.5; we ship 3.6.1
CVE-2016-2107	openssl	3.6.1	fixed upstream in 1:1.0.1e-51.el7_2.5; we ship 3.6.1
CVE-2016-2108	openssl	3.6.1	fixed upstream in 1:1.0.1e-51.el7_2.5; we ship 3.6.1
CVE-2016-2109	openssl	3.6.1	fixed upstream in 1:1.0.1e-51.el7_2.5; we ship 3.6.1
CVE-2016-2177	openssl	3.6.1	fixed upstream in 0:1.0.1e-48.el6_8.3; we ship 3.6.1
CVE-2016-2178	openssl	3.6.1	fixed upstream in 0:1.0.1e-48.el6_8.3; we ship 3.6.1
CVE-2016-2179	openssl	3.6.1	fixed upstream in 0:1.0.1e-48.el6_8.3; we ship 3.6.1
CVE-2016-2180	openssl	3.6.1	fixed upstream in 0:1.0.1e-48.el6_8.3; we ship 3.6.1
CVE-2016-2181	openssl	3.6.1	fixed upstream in 0:1.0.1e-48.el6_8.3; we ship 3.6.1
CVE-2016-2182	openssl	3.6.1	fixed upstream in 0:1.0.1e-48.el6_8.3; we ship 3.6.1
CVE-2016-2183	openssl	3.6.1	fixed upstream in 0:1.0.1e-48.el6_8.3; we ship 3.6.1
CVE-2016-2842	openssl	3.6.1	fixed upstream in 1:1.0.1e-51.el7_2.5; we ship 3.6.1
CVE-2016-6302	openssl	3.6.1	fixed upstream in 0:1.0.1e-48.el6_8.3; we ship 3.6.1
CVE-2016-6304	openssl	3.6.1	fixed upstream in 0:1.0.1e-48.el6_8.3; we ship 3.6.1
CVE-2016-6306	openssl	3.6.1	fixed upstream in 0:1.0.1e-48.el6_8.3; we ship 3.6.1
CVE-2016-7056	openssl	3.6.1	fixed upstream in 1:1.0.2k-8.el7; we ship 3.6.1
CVE-2016-8610	openssl	3.6.1	fixed upstream in 0:1.0.1e-48.el6_8.4; we ship 3.6.1
CVE-2017-3731	openssl	3.6.1	fixed upstream in 0:1.0.1e-48.el6_8.4; we ship 3.6.1
CVE-2017-3735	openssl	3.6.1	fixed upstream in 1:1.0.2k-16.el7; we ship 3.6.1
CVE-2017-3736	openssl	3.6.1	fixed upstream in 1:1.0.2k-12.el7; we ship 3.6.1
CVE-2017-3737	openssl	3.6.1	fixed upstream in 1:1.0.2k-12.el7; we ship 3.6.1
CVE-2017-3738	openssl	3.6.1	fixed upstream in 1:1.0.2k-12.el7; we ship 3.6.1
CVE-2018-0495	openssl	3.6.1	fixed upstream in 1:1.0.2k-16.el7; we ship 3.6.1
CVE-2018-0732	openssl	3.6.1	fixed upstream in 1:1.0.2k-16.el7; we ship 3.6.1
CVE-2018-0734	openssl	3.6.1	fixed upstream in 1:1.1.1c-2.el8; we ship 3.6.1
CVE-2018-0735	openssl	3.6.1	fixed upstream in 1:1.1.1c-2.el8; we ship 3.6.1
CVE-2018-0737	openssl	3.6.1	fixed upstream in 1:1.0.2k-16.el7; we ship 3.6.1
CVE-2018-0739	openssl	3.6.1	fixed upstream in 1:1.0.2k-16.el7; we ship 3.6.1
CVE-2018-5407	openssl	3.6.1	fixed upstream in 1:1.0.2k-16.el7_6.1; we ship 3.6.1
CVE-2019-1543	openssl	3.6.1	fixed upstream in 1:1.1.1c-2.el8; we ship 3.6.1
CVE-2019-1547	openssl	3.6.1	fixed upstream in 1:1.1.1c-15.el8; we ship 3.6.1
CVE-2019-1549	openssl	3.6.1	fixed upstream in 1:1.1.1c-15.el8; we ship 3.6.1
CVE-2019-1551	openssl	3.6.1	fixed upstream in 1:1.1.1g-11.el8; we ship 3.6.1
CVE-2019-1559	openssl	3.6.1	fixed upstream in 1:1.0.2k-19.el7; we ship 3.6.1
CVE-2019-1563	openssl	3.6.1	fixed upstream in 1:1.1.1c-15.el8; we ship 3.6.1
CVE-2020-1971	openssl	3.6.1	fixed upstream in 1:1.1.1c-16.el8_2; we ship 3.6.1
CVE-2021-23840	openssl	3.6.1	fixed upstream in 1:1.1.1k-4.el8; we ship 3.6.1
CVE-2021-23841	openssl	3.6.1	fixed upstream in 1:1.1.1k-4.el8; we ship 3.6.1
CVE-2021-3449	openssl	3.6.1	fixed upstream in 1:1.1.1c-18.el8_2; we ship 3.6.1
CVE-2021-3450	openssl	3.6.1	fixed upstream in 1:1.1.1g-15.el8_3; we ship 3.6.1
CVE-2021-3712	openssl	3.6.1	fixed upstream in 1:1.1.1k-5.el8_5; we ship 3.6.1
CVE-2022-0778	openssl	3.6.1	fixed upstream in 1:1.1.1c-19.el8_2; we ship 3.6.1
CVE-2022-1292	openssl	3.6.1	fixed upstream in 1:3.0.1-41.el9_0; we ship 3.6.1
CVE-2022-1343	openssl	3.6.1	fixed upstream in 1:3.0.1-41.el9_0; we ship 3.6.1
CVE-2022-1473	openssl	3.6.1	fixed upstream in 1:3.0.1-41.el9_0; we ship 3.6.1
CVE-2022-2068	openssl	3.6.1	fixed upstream in 1:3.0.1-41.el9_0; we ship 3.6.1
CVE-2022-2097	openssl	3.6.1	fixed upstream in 1:3.0.1-41.el9_0; we ship 3.6.1
CVE-2022-3358	openssl	3.6.1	fixed upstream in 1:3.0.7-6.el9_2; we ship 3.6.1
CVE-2022-3602	openssl	3.6.1	fixed upstream in 1:3.0.1-43.el9_0; we ship 3.6.1
CVE-2022-3786	openssl	3.6.1	fixed upstream in 1:3.0.1-43.el9_0; we ship 3.6.1
CVE-2022-4203	openssl	3.6.1	fixed upstream in 1:3.0.1-47.el9_1; we ship 3.6.1
CVE-2022-4304	openssl	3.6.1	fixed upstream in 1:3.0.1-47.el9_1; we ship 3.6.1
CVE-2022-4450	openssl	3.6.1	fixed upstream in 1:3.0.1-47.el9_1; we ship 3.6.1
CVE-2023-0215	openssl	3.6.1	fixed upstream in 1:3.0.1-47.el9_1; we ship 3.6.1
CVE-2023-0216	openssl	3.6.1	fixed upstream in 1:3.0.1-47.el9_1; we ship 3.6.1
CVE-2023-0217	openssl	3.6.1	fixed upstream in 1:3.0.1-47.el9_1; we ship 3.6.1
CVE-2023-0286	openssl	3.6.1	fixed upstream in 1:3.0.1-47.el9_1; we ship 3.6.1
CVE-2023-0401	openssl	3.6.1	fixed upstream in 1:3.0.1-47.el9_1; we ship 3.6.1
CVE-2023-0464	openssl	3.6.1	fixed upstream in 1:3.0.7-16.el9_2; we ship 3.6.1
CVE-2023-0465	openssl	3.6.1	fixed upstream in 1:3.0.7-16.el9_2; we ship 3.6.1
CVE-2023-0466	openssl	3.6.1	fixed upstream in 1:3.0.7-16.el9_2; we ship 3.6.1
CVE-2023-1255	openssl	3.6.1	fixed upstream in 1:3.0.7-16.el9_2; we ship 3.6.1
CVE-2023-2650	openssl	3.6.1	fixed upstream in 1:3.0.7-16.el9_2; we ship 3.6.1
CVE-2023-2975	openssl	3.6.1	fixed upstream in 1:3.0.7-27.el9; we ship 3.6.1
CVE-2023-3446	openssl	3.6.1	fixed upstream in 1:3.0.7-27.el9; we ship 3.6.1
CVE-2023-3817	openssl	3.6.1	fixed upstream in 1:3.0.7-27.el9; we ship 3.6.1
CVE-2023-5363	openssl	3.6.1	fixed upstream in 1:3.0.7-25.el9_3; we ship 3.6.1
CVE-2023-5678	openssl	3.6.1	fixed upstream in 1:3.0.7-27.el9; we ship 3.6.1
CVE-2023-6129	openssl	3.6.1	fixed upstream in 1:3.0.7-27.el9; we ship 3.6.1
CVE-2023-6237	openssl	3.6.1	fixed upstream in 1:3.0.7-27.el9; we ship 3.6.1
CVE-2024-0727	openssl	3.6.1	fixed upstream in 1:3.0.7-27.el9; we ship 3.6.1
CVE-2024-12797	openssl	3.6.1	fixed upstream in 1:3.2.2-16.el10; we ship 3.6.1
CVE-2024-2408	openssl	3.6.1	fixed upstream in 1:1.1.1k-12.el8_9; we ship 3.6.1
CVE-2024-2511	openssl	3.6.1	fixed upstream in 1:3.2.2-6.el9_5; we ship 3.6.1
CVE-2024-4603	openssl	3.6.1	fixed upstream in 1:3.2.2-6.el9_5; we ship 3.6.1
CVE-2024-4741	openssl	3.6.1	fixed upstream in 1:3.2.2-6.el9_5; we ship 3.6.1
CVE-2024-5535	openssl	3.6.1	fixed upstream in 1:3.2.2-6.el9_5; we ship 3.6.1
CVE-2024-6119	openssl	3.6.1	fixed upstream in 1:3.0.7-28.el9_4; we ship 3.6.1
CVE-2025-11187	openssl	3.6.1	fixed upstream in 1:3.5.1-7.el10_1; we ship 3.6.1
CVE-2025-15467	openssl	3.6.1	fixed upstream in 1:3.5.1-7.el10_1; we ship 3.6.1
CVE-2025-15468	openssl	3.6.1	fixed upstream in 1:3.5.1-7.el10_1; we ship 3.6.1
CVE-2025-15469	openssl	3.6.1	fixed upstream in 1:3.5.1-7.el10_1; we ship 3.6.1
CVE-2025-66199	openssl	3.6.1	fixed upstream in 1:3.5.1-7.el10_1; we ship 3.6.1
CVE-2025-68160	openssl	3.6.1	fixed upstream in 1:3.5.1-7.el10_1; we ship 3.6.1
CVE-2025-69418	openssl	3.6.1	fixed upstream in 1:3.5.1-7.el10_1; we ship 3.6.1
CVE-2025-69419	openssl	3.6.1	fixed upstream in 1:3.5.1-7.el10_1; we ship 3.6.1
CVE-2025-69420	openssl	3.6.1	fixed upstream in 1:3.5.1-7.el10_1; we ship 3.6.1
CVE-2025-69421	openssl	3.6.1	fixed upstream in 1:3.5.1-7.el10_1; we ship 3.6.1
CVE-2025-9230	openssl	3.6.1	fixed upstream in 1:3.5.1-4.el10_1; we ship 3.6.1
CVE-2025-9231	openssl	3.6.1	fixed upstream in 0:3.5.6-0.1.hum1; we ship 3.6.1
CVE-2025-9232	openssl	3.6.1	fixed upstream in 0:3.5.6-0.1.hum1; we ship 3.6.1
CVE-2026-14456	openssl	3.6.1	fixed upstream in 1:3.5.8-1.el10_2; we ship 3.6.1
CVE-2026-14457	openssl	3.6.1	fixed upstream in 1:3.5.8-1.el10_2; we ship 3.6.1
CVE-2026-18798	openssl	3.6.1	fixed upstream in 1:3.5.8-1.el10_2; we ship 3.6.1
CVE-2026-22795	openssl	3.6.1	fixed upstream in 1:3.5.1-7.el10_1; we ship 3.6.1
CVE-2026-22796	openssl	3.6.1	fixed upstream in 1:3.5.1-7.el10_1; we ship 3.6.1
CVE-2026-2673	openssl	3.6.1	fixed upstream in 1:3.5.5-3.el9_8; we ship 3.6.1
CVE-2026-28386	openssl	3.6.1	fixed upstream in 0:3.5.6-0.1.hum1; we ship 3.6.1
CVE-2026-28387	openssl	3.6.1	fixed upstream in 0:3.5.6-0.1.hum1; we ship 3.6.1
CVE-2026-28388	openssl	3.6.1	fixed upstream in 0:3.5.6-0.1.hum1; we ship 3.6.1
CVE-2026-28389	openssl	3.6.1	fixed upstream in 0:3.5.6-0.1.hum1; we ship 3.6.1
CVE-2026-28390	openssl	3.6.1	fixed upstream in 1:3.5.5-3.el10_2; we ship 3.6.1
CVE-2026-31789	openssl	3.6.1	fixed upstream in 0:3.5.6-0.1.hum1; we ship 3.6.1
CVE-2026-31790	openssl	3.6.1	fixed upstream in 1:3.5.5-2.el10_2; we ship 3.6.1
CVE-2026-34180	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2026-34181	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2026-34182	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2026-34183	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2026-35188	openssl	3.6.1	fixed upstream in 0:3.5.8-0.1.hum1; we ship 3.6.1
CVE-2026-35189	openssl	3.6.1	fixed upstream in 0:3.5.9-0.1.hum1; we ship 3.6.1
CVE-2026-35191	openssl	3.6.1	fixed upstream in 0:3.5.9-0.1.hum1; we ship 3.6.1
CVE-2026-42764	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2026-42765	openssl	3.6.1	fixed upstream in 0:3.5.8-0.1.hum1; we ship 3.6.1
CVE-2026-42766	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2026-42767	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2026-42768	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2026-42769	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2026-42770	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2026-42771	openssl	3.6.1	fixed upstream in 0:3.5.8-0.1.hum1; we ship 3.6.1
CVE-2026-42772	openssl	3.6.1	fixed upstream in 0:3.5.9-0.1.hum1; we ship 3.6.1
CVE-2026-45445	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2026-45446	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2026-45447	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2026-54872	openssl	3.6.1	fixed upstream in 0:3.5.9-0.1.hum1; we ship 3.6.1
CVE-2026-54873	openssl	3.6.1	fixed upstream in 0:3.5.9-0.1.hum1; we ship 3.6.1
CVE-2026-54874	openssl	3.6.1	fixed upstream in 1:3.5.8-1.el10_2; we ship 3.6.1
CVE-2026-54875	openssl	3.6.1	fixed upstream in 0:3.5.9-0.1.hum1; we ship 3.6.1
CVE-2026-54876	openssl	3.6.1	fixed upstream in 0:3.5.6-0.5.hum1; we ship 3.6.1
CVE-2026-63072	openssl	3.6.1	fixed upstream in 1:3.5.8-1.el10_2; we ship 3.6.1
CVE-2026-63073	openssl	3.6.1	fixed upstream in 1:3.5.8-1.el10_2; we ship 3.6.1
CVE-2026-63074	openssl	3.6.1	fixed upstream in 1:3.5.8-1.el10_2; we ship 3.6.1
CVE-2026-63075	openssl	3.6.1	fixed upstream in 1:3.5.8-1.el10_2; we ship 3.6.1
CVE-2026-63076	openssl	3.6.1	fixed upstream in 1:3.5.8-1.el10_2; we ship 3.6.1
CVE-2026-72897	openssl	3.6.1	fixed upstream in 0:3.5.9-0.1.hum1; we ship 3.6.1
CVE-2026-7383	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2026-75803	openssl	3.6.1	fixed upstream in 0:3.5.8-0.1.hum1; we ship 3.6.1
CVE-2026-75804	openssl	3.6.1	fixed upstream in 0:3.5.9-0.1.hum1; we ship 3.6.1
CVE-2026-75805	openssl	3.6.1	fixed upstream in 0:3.5.9-0.1.hum1; we ship 3.6.1
CVE-2026-75806	openssl	3.6.1	fixed upstream in 0:3.5.9-0.1.hum1; we ship 3.6.1
CVE-2026-77696	openssl	3.6.1	fixed upstream in 0:3.5.9-0.1.hum1; we ship 3.6.1
CVE-2026-84782	openssl	3.6.1	fixed upstream in 1:3.5.8-2.el10_2; we ship 3.6.1
CVE-2026-84783	openssl	3.6.1	fixed upstream in 0:3.5.8-0.1.hum1; we ship 3.6.1
CVE-2026-84784	openssl	3.6.1	fixed upstream in 0:3.5.9-0.1.hum1; we ship 3.6.1
CVE-2026-9076	openssl	3.6.1	fixed upstream in 1:3.5.5-4.el10_2; we ship 3.6.1
CVE-2019-20454	pcre2	10.49	fixed upstream in 0:10.32-2.el8; we ship 10.49
CVE-2022-1586	pcre2	10.49	fixed upstream in 0:10.37-5.el9_0; we ship 10.49
CVE-2022-1587	pcre2	10.49	fixed upstream in 0:10.37-5.el9_0; we ship 10.49
CVE-2026-103111	pcre2	10.49	the fix 6f9d7c137326 is in pcre2-10.49, the release we ship (PCRE2Project/pcre2 says identical)
CVE-2026-86145	pcre2	10.49	fixed upstream in 0:10.48-0.1.hum1; we ship 10.49
CVE-2026-89156	pcre2	10.49	fixed upstream in 0:10.48-0.1.hum1; we ship 10.49
CVE-2026-89157	pcre2	10.49	fixed upstream in 0:10.48-0.1.hum1; we ship 10.49
CVE-2026-89158	pcre2	10.49	fixed upstream in 0:10.48-0.1.hum1; we ship 10.49
CVE-2026-89160	pcre2	10.49	fixed upstream in 0:10.48-0.1.hum1; we ship 10.49
CVE-2026-89161	pcre2	10.49	fixed upstream in 0:10.48-0.1.hum1; we ship 10.49
CVE-2026-89162	pcre2	10.49	fixed upstream in 0:10.48-0.1.hum1; we ship 10.49
CVE-2025-5455	qt6-qtbase	6.8.2	fixed upstream in 0:6.8.1-9.el10_0; we ship 6.8.2
CVE-2026-11573	qt6-qtbase	6.8.2	Qt states that 6.8.2 is outside the affected releases (https://www.qt.io/blog/security-advisory-cve-2026-11573)
CVE-2022-1271	xz-libs	5.8.3	fixed upstream in 0:5.2.5-8.el9_0; we ship 5.8.3
CVE-2025-31115	xz-libs	5.8.3	fixed upstream in 1:5.6.2-4.el10_0; we ship 5.8.3
CVE-2026-34743	xz-libs	5.8.3	the fix 4b73f2ec19a9 is in v5.8.3, the release we ship (tukaani-project/xz says identical)
CVE-2005-1849	zlib	1.3.1	fixed upstream in 0:1.2.1.2-1.2; we ship 1.3.1
CVE-2005-2096	zlib	1.3.1	fixed upstream in 0:1.2.1.2-1.1; we ship 1.3.1
CVE-2016-9840	zlib	1.3.1	fixed upstream in 0:1.2.7-21.el7_9.1; we ship 1.3.1
CVE-2018-25032	zlib	1.3.1	fixed upstream in 0:1.2.11-31.el9_0.1; we ship 1.3.1
CVE-2022-37434	zlib	1.3.1	fixed upstream in 0:1.2.11-32.el9_0; we ship 1.3.1